(iii) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and (iv) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. (b) The Office may lay down technical standards for the requirements specified in paragraph (a). (3) In determining the appropriate security measures referred to in subsection (1), in particular, where the processing involves the transmission of data over an information and communication network, a controller shall have regard to – (a) the state of technological development available; (b) the cost of implementing any of the security measures; (c) the special risks that exist in the processing of the data; and (d) (4) the nature of the data being processed. Where a controller is using the services of a processor – (a) he or it shall choose a processor providing sufficient guarantees in respect of security and organisational measures for the purpose of